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Amendments to the Claims 
This listing of claims will replace all prior versions of claims in the application: 
Listing of Claims: 

1 . (Currently Amended) A computer implemented system that facilitates classifying 
messages in connection with spam prevention, comprising: 

a component that receives a set of the messages; 

a first classification component that identifies a subset of the messages as SPAM or 
flagged for further analysis, and temporarily delays further classification of the subset of 
messages; and 

a second classification component that after a dotorminod delay period classifies the 
subset of messages by employing a filter that is updated during the delay period based at least in 
part on one or more learning techniques that are employed to receive additional data associated 
with the subset of messages during the determined delay period, the additional data includes data 
based on an analysis of the subset of messages , the delay period is dynamically determined based 
in part on at least one of a probability that the set of messages are spam, a time of next filter 
update, a time of next filter download or a level of uncertainty, the determined delay period is 
reduced when determined that the subset of messages have been quarantined by one or more 
server filters, 

wherein a memory operatively coupled to a processor retains at least one of the 
component, the first classification component or the second classification component . 

2. (Original) The system of claim 1, the second classification component identifying some 
of the subset of messages as good based on a lack of sufficient new negative information. 

3. (Original) The system of claim 1, the second classification component identifying some 
of the subset of messages as good based on new positive information other than a close match to 
a good message. 
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4. (Original) The system of claim 1, the messages are classified as spam or flagged or 
delayed based on a lack of information. 

5 . (Original) The system of claim 1 , the messages are reclassified based on updated 
information from a machine learning spam filter. 

6. (Original) The system of claim 2, wherein the lack of sufficient new negative information 
comprises the lack of appearance of similar messages in honeypots. 

7. (Original) The system of claim 2, wherein the lack of sufficient new negative information 
comprises a lack of user complaints on similar information. 

8. (Original) The system of claim 2, the lack of sufficient new negative information 
comprises information from polling users about at least a subset of messages. 

9. (Original) The system of claim 2, the lack of sufficient new negative information 
comprises a low volume of similar messages. 

10. (Original) The system of claim 8, the messages are classified as similar based on the 
sender's identity. 

1 1 . (Original) The system of claim 10, the sender's identity is classified based on his IP 
address. 

12. (Original) The system of claim 8, the similarity of messages is based on the URLs 
contained in the messages. 

13. (Original) The system of claim 1, messages initially classified as spam are deleted based 
on new information. 

14. (Original) The system of claim 1 , the spam is permanently deleted. 
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15. (Original) The system of claim 1, the spam is moved to a deleted messages folder. 

16. (Original) The system of claim 1, further comprising a feedback component that receives 
information relating to the first and/or second classification component(s)', and employs the 
information in connection with training a spam filter or populating a spam list. 

17. (Original) The system of claim 1, wherein the messages comprise at least one of: 
electronic mail (e-mail) and messages. 

18. (Original) The system of claim 1, wherein the component that receives a set of the 
messages is any one of an e-mail server, a message server, and client e-mail software. 

1 9 . (Currently Amended) A server employing tho system of claim 1 that facilitates 
classifying messages in connection with spam prevention, comprising: 

a component that receives a set of the messages; 

a first classification component that identifies a subset of the messages as SPAM or 

flagged for further analysis, and temporarily delays further classification of the subset of 
messages; and 

a second classification component that after a delay period classifies the subset of 

messages by employing a filter that is updated during the delay period based at least in part on 
one or more learning techniques that are employed to receive additional data associated with the 
subset of messages during the determined delay period, the additional data includes data based 
on an analysis of the subset of messages, the delay period is dynamically determined based in 
part on at least one of a probability that the set of messages are spam, a time of next filter update, 
a time of next filter download or a level of uncertainty, the determined delay period is reduced 
when determined that the subset of messages have been quarantined by one or more server 
filters, 

wherein a memory operatively coupled to a processor retains at least one of the 
component, the first classification component or the second classification component . 
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20. (Currently Amended) An e-mail architecture employing the system of claim 1 that 
facilitates classifying messages in connection with spam prevention, comprising: 
a component that receives a set of the messages; 

a first classification component that identifies a subset of the messages as SPAM or 

flagged for further analysis, and temporarily delays further classification of the subset of 
messages; and 

a second classification component that after a delay period classifies the subset of 

messages by employing a filter that is updated during the delay period based at least in part on 
one or more learning techniques that are employed to receive additional data associated with the 
subset of messages during the determined delay period, the additional data includes data based 
on an analysis of the subset of messages, the delay period is dynamically determined based in 
part on at least one of a probability that the set of messages are spam, a time of next filter update, 
a time of next filter download or a level of uncertainty, the determined delay period is reduced 
when determined that the subset of messages have been quarantined by one or more server 
filters, 

wherein a memory opcrativcly coupled to a processor retains at least one of the 
component, the first classification component or the second classification component . 

21 . (Currently Amended) A computer readable storage m edium having stored thereon the 
components of claim 1 that facilitates classifying messages in connection with spam prevention, 
comprising: 

a component that receives a set of the messages; 

a first classification component that identifies a subset of the messages as SPAM or 

flagged for further analysis, and temporarily delays further classification of the subset of 
messages; and 

a second classification component that after a delay period classifies the subset of 

messages by employing a filter that is updated during the delay period based at least in part on 
one or more learning techniques that are employed to receive additional data associated with the 
subset of messages during the determined delay period, the additional data includes data based 
on an analysis of the subset of messages, the delay period is dynamically determined based in 
part on at least one of a probability that the set of messages are spam, a time of next filter update, 
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a time of next filter download or a level of uncertainty, the determined delay period is reduced 
when determined that the subset of messages have been quarantined by one or more server 
filters . 

22. (Original) The system of claim 1, further comprising a quarantine component that 
quarantines the subset of messages based at least in part upon identification as flagged for further 
analysis by the first classification component. 

23. (Original) The system of claim 1, the quarantining effected via placing the subset of 
messages in a folder separate from other messages. 

24. (Original) The system of claim 1, the folder is visible or invisible to a user. 

25. (Original) The system of claim 1, further comprising an identification component that 
identifies a source associated with a high occurrence of the subset of messages. 

26. (Currently Amended) The system of claim 1, further comprising a time-stamp component 
that stamps at least one of an original arrival date on [[the]] a message and a release date when 
the message is classified as good by the second classification component, the message sorted by 
the release date classification of the message resumes . 

27. (Original) The system of claim 1, the subset of messages excludes at least one of 
messages from senders on safelists, messages readily identified and classified as spam, messages 
readily identified and classified as good. 

28. (Original) The system of 1, the first classification component determines length of delay 
before classification of the subset of messages is performed. 

29. (Original) The system of claim 28, the length of delay is based at least in part upon at 
least one of the following: 

amount of time until a next scheduled filter update; 
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amount of time until download of new or updated filter; and 

spam probability score assigned to respective messages in the subset. 

30. (Currently Amended) A method for classifying messages, comprising: 
receiving a set of messages to classify; based on lack of sufficient information, 

temporarily delaying classification on at least a subset of the messages as either spam or good or 
initially classifying the subset of messages as untrustworthy or suspicious; 

dynamically determining a delay time period based at least in part upon at least one of a 
probability that the message is spam, a time of next filter update, a time of next filter download 
or a level of uncertainty associated with the subset of the messages; and 

classifying the untrustworthy or suspicious subset of messages as spam or good after the 
determined delay period by employing a client filter that is updated during the delay period 
based at least in part on one or more learning techniques that are employed during the 
determined delay period to receive additional data associated with the subset of messages, the 
one or more learning techniques include at least one of monitoring the subset of the messages 
with respect to at least one of volume per sender or similarities among quarantined messages, or 
analyzing the subset of the messages for at least one of their content or origination information; 
and 

reducing the delay time period associated with the client filter for a message when 
determined that one or more server filters have quarantined a message for a time period . 

3 1 . (Original) The method of claim 30, further comprising a machine learning filter trained 
to determine the likelihood of quarantining aiding a correct eventual classification. 

32. (Original) The method of claim 30, further comprising resuming classification when at 
least one of the following occurs: 

a quarantine period elapses; and 

additional information about the subset of messages has been obtained to facilitate 
classification of the respective messages in the subset as either spam or good. 
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33. (Original) The method of claim 30, the subset of messages excluding messages that is 
readily classified as spam or good or is from senders on a safelist. 

34. (Original) The method of claim 30, temporarily delaying classification of the message 
when based at least in part upon at least one of the following: 

sender's IP address on the message has not been seen before; 
sender's domain has not been seen before; 
sender's domain lacks a reverse IP address; 

a forward lookup on the sender's domain does not at least approximately 
match the sender's IP address; 

the message comprises at least one of an embedded domain name, an 
embedded macro, and an executable file; 

the message comprises conflicting evidence of good and spam messages; 

the message originates from a location associated with spam; 

the message is written in a language associated with spam; 

the message comprises primarily an image; and 

the message comprises HTML. 

35. (Previously Presented) The method of claim 30, further comprising delivering at least a 
subset of suspicious messages. 

36. (Original) The method of claim 35, the subset of suspicious messages is delivered to their 
respective intended recipients and their actions facilitate determining whether the subset of 
messages is spam or good. 



37. (Original) The method of claim 35, the subset of messages for which feedback is sought 
is a fixed percentage of messages or a fixed quantity of messages per sender that are temporarily 
delayed from classification. 
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38. (Original) The method of claim 35, the subset of messages for which feedback is sought 
is allowed to get through without classification as either spam or good to facilitate learning more 
about the messages. 

39. (Currently Amended) A computer executable API stored on a computer readable storage 
medium that facilitates classifying messages by quarantining^ comprising: 

calculating a spam probability score for incoming messages; 

quarantining at least a subset of messages based at least in part upon their respective 
spam probability scores; and 

dynamically recommending a quarantine time based in part on at least one of a 
probability that the set of messages are spam, a time of next filter update, a time of next filter 
download or a level of uncertainty 7 ; 

updating one or more spam filters during the quarantine time t he quarantined subset of 
m e ssages classified as good or spam after the quarantine time based at least in part on one or 
more learning techniques that are employed during the quarantine time to receive additional data 
associated with the subset of messages; 

classifying the quarantined subset of messages as good or spam after the quarantine time 
by employing the one of more updated spam filters; and 

communicating between server and client that one or more server filters have quarantined 
a message for a time period so that the one or more client filters reduce quarantine time for the 
message . 

40. (Original) The API of claim 39, further comprising quarantining at least a subset of 
messages until the next filter download, at which time the filter determines whether to continue 
quarantining or resume classification of the messages; and repeating until a final classification of 
either spam or good is made. 

41. (Cancelled) 

42. (Currently Amended) A computer implemented system for classifying messages, 
comprising: 
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means for receiving a set of messages to classify; 

means for based on lack of sufficient information, temporarily delaying classification on 
the message as either spam or good or initially classifying the message as untrustworthy or 
suspiciousirand 

means for dynamically determining a delay period based in part on at least one of a 
probability that the set of messages are spam, a time of next filter update, a time of next filter 
download or a level of uncertainty; 

[[a]] means for classifying the untrustworthy or suspicious subset of messages as spam or 
good after [[a]] the determined delay period based at least in part on one or more learning 
techniques employed during the determined delay period to receive additional data associated 
with the subset of messages , the additional data includes message volume; 

means for creating a sub-filter by employing training data generated by user and system 
analysis, the sub-filter is trained on one or more features extracted from the untrustworthy or 
suspicious messages; 

means for applying the sub-filter to the untrustworthy or suspicious messages to classify 
the untrustworthy or suspicious messages as good or spam; 

means for communicating between server and client to determine messages that arc- 
quarantined by one or more server filters for a time period; and 

means for reducing the determined delay period for the determined message 

wherein a memory operatively coupled to a processor retains at least one of the means . 
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